That could work too...but if you let any traffic out of the VM on any port, it's conceivable that malware could use that.

It all depends on how paranoid you want to be. Given your wife's penchant for dodgy websites, I'd go with a more paranoid solution: a totally separate PC. Get her a nice big monitor, put Chrome OS or Linux on the PC, and put it on a separate VLAN.